Library · Crypto, word by word · Transactions and fees
What is a token approval?
A token approval is a permission you sign that lets another address, usually an app's smart contract, move a set amount of a token from your wallet. Under the ERC-20 standard the approved spender can withdraw repeatedly up to that amount, without asking you again.
What it means for you
Many apps request an unlimited approval. If that contract is malicious or later compromised, it can take the approved tokens from your wallet with no recovery, even after you stop using the app. The approval stays active until you revoke it.
A common mistake: “If I withdraw my tokens from the app, its approval ends.”
In fact: The approval is recorded in the token's contract, not in the app. ethereum.org notes that a platform with unlimited access can spend those tokens even after you withdraw your funds back to your wallet.
How it works
ERC-20 splits spending into two steps. You call approve with a spender and an amount, which records an allowance; the spender then calls transferFrom to pull tokens from your balance, as many times as it likes until the allowance is used up. The allowance function returns what is left, and an Approval event logs each change. The standard tells wallet interfaces to set an allowance to 0 before changing it to another value for the same spender, to block an attack on the change. NFT contracts use setApprovalForAll, which covers every token you hold in that contract.
An example
Say a swap app asks to approve an unlimited amount of a token and you swap 100 units. The app's contract keeps an allowance far larger than 100. If that wallet later holds 5,000 units, the contract can still pull all 5,000 without a new signature until you revoke the approval.
Sources: EIP-20: Token Standard, ethereum.org: How to revoke smart contract access, EIP-721: Non-Fungible Token Standard · checked 4 October 2026
On Cryptominium
Related words
Educational content, not financial advice. Written by hand and checked against the source named above. Something wrong? Tell us and we reply within two business days.